It Usually Starts Small
No one wakes up and shuts down a city.
It usually starts with something.
A forgotten VPN account.
An exposed remote desktop service.
A contractor login that never got removed.
Nothing explodes.
Nothing crashes.
At first, everything works.
Step One: Quiet Network Access
Initial access often looks harmless.
Common real-world entry points:
1. VPN credentials reused from another breach
2. Exposed RDP with weak or reused passwords
3. Edge devices running unpatched firmware
4. Third-party access with broad permissions
From the logs, it looks like a normal user logging in.
Because it is technically.
Step Two: Learning the Environment
Attackers don’t rush.
They map.
Typical activity after access:
1. Listing Active Directory users and groups
2. Querying file shares
3. Checking backup systems
4. Identifying admin workstations
This phase can last days or weeks.
Analogy:
It’s like walking into a city and learning bus routes before driving anything heavy.
Step Three: Lateral Movement
Once the layout is clear, movement begins.
Often using:
1. SMB and RDP
2. PsExec
3. Built-in admin tools
4. Service accounts with excessive rights
Step Four: Targeting What Actually Matters
Attackers don’t aim for “servers.”
They aim for impact.
In city environments, that means:
1. Dispatch systems
2. Billing platforms
3. Traffic management
4. Utilities monitoring
5. Emergency communication tools
They avoid touching everything at once.
They choose leverage.
Step Five: The Switch Gets Flipped
The shutdown doesn’t always look like malware.
Sometimes it’s:
1. Disabled services
2. Corrupted databases
3. Encrypted backups
4. Admin accounts locked out
The systems are still there.
They just don’t function.
Why Cities Are Especially Vulnerable
Municipal networks have unique challenges:
1. Legacy systems that can’t be patched
2. Flat networks for “operational convenience”
3. Vendors with persistent access
4. Limited visibility into east-west traffic
Security teams often know this.
They just don’t control the budget.
What This Looks Like in Logs (Before the Shutdown)
The warning signs are rarely dramatic.
Common patterns:
1. One account authenticating to many systems
2. Gradual increase in RDP and SMB usage
3. Access outside normal job function
4. Backup systems accessed unexpectedly
5. Admin tools executed from non-admin machines
Each event alone looks normal.
Together, they tell a story.
Practical Lessons
Stopping a city shutdown doesn’t require predicting attackers.
It requires limiting movement.
Effective controls include:
1. Strict segmentation between IT and OT
2. Monitoring service account behavior
3. Limiting VPN access by role and location
4. Logging internal authentication, not just perimeter access
5. Treating backup systems as high-value targets
Defense here is about friction, not perfection.
A Simple Way to Think About It
Cities don’t fall because of one exploit.
They fall because access spreads.
If one login can reach everything,
eventually someone will use it that way.
